Organizing GPOs 3

[LawnBoy]

I'm currently creating seperate GPOs for each particular policy enforced; i.e. a GPO for power mgmt, a GPO for WinFirewall, a GPO for IE settings, etc. I'm starting to amass quite a few GPOs and I'm wondering if I could be negatively impacting bootup times by causing so many scripts to be parsed.

Should I continue creating separate GPOs, or would it be better to combine GPOs where possible?

Also, my co-admins are complaining about the lack of documentation relating the GPO name with the OU it is applied to and the particular settings it contains. Before I create a spreadsheet to statically track this info, how are you tracking this info?


"We must fall back upon the old axiom that when all other contingencies fail, whatever remains, however improbable, must be the truth." - Sherlock Holmes

 

[GrimR]

I do the same thing. [Dont know if this is correct or not but I'm the only person running the network, so conforms to my way of thinking].
As for documentation if you run gpmc.msc under settings just click show all and the settings are visable.

 

[LawnBoy]

Thanks for the tip on gpmc.msc. It's far better than the Group Policy MMC plugin.


"We must fall back upon the old axiom that when all other contingencies fail, whatever remains, however improbable, must be the truth." - Sherlock Holmes

 

[terry712]

i like the gpo's that do single type items as you describe.

it does mean there are more of them but as long as the naming is semi logical then whats the problem - and the report from the snapin is dare i say it for ms quite good

the problem i find with large policies is - someone needs some slightly different tweak so you end up either with a small extra policy or 2 large policies that do huge amount of things except one has green wallpaper and the other one has pink with yellow flowers

i do keep a spreadsheet but it is more a date change type thing so that if problems occur we have a change reference to look at in case it is a policy change issue - it's not to log what the policy is

 

[58sniper]

Keep in mind that without significant optimization, that can make for a LOT of file transfer during bootup, login, logoff, and shutdown (depending on your policies). Policies can get quite big, sometimes several MB each. Combining them, and then optimizing them, can certainly cause things to go much quicker.

Pat Richard
Microsoft Exchange MVP